Re: AUTIA authentication sometimes fails

[Rémi Denis-Courmont]

Le maanantaina 29. maaliskuuta 2021, 23.07.20 EEST Derrick McKee a écrit :
> I am running across a scenario where a PAC signed code pointer (using
> pacia) sometimes does not successfully authenticate despite the signed
> pointer and the salt used to sign the pointer are correctly given to a
> autia instruction.  Only one particular pointer fails, while others
> are correctly authenticated.  Unfortunately, I can't provide a simple
> use case, because the behavior is part of a running kernel, and all
> the pointers involved are kernel space pointers.  An example of what I
> am seeing (not guaranteeing correct assembly, just a gist):
> 
> mov x9, 0xffff800009200000
> mov x10, 0x20001
> pacia x9, x10  // x9 contains 0xff90800009200000
> ...
> mov x9, 0xff90800009200000
> mov x10 0x20001
> autia x9, x10  // x9 contains invalid pointer

That's not how PAuth works. x9 must be a signed value in the second block, so 
it shouldn't be possible to supply a constant there, at least not in any 
reasonable use.

-- 
雷米‧德尼-库尔蒙
http://www.remlab.net/